Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
24-05-2024 04:54
General
-
Target
$PLUGINSDIR/AhnRpt.exe
-
Size
289KB
-
MD5
c41c2078d41317491b8fc6ce81b825ab
-
SHA1
003ef5d4f98e098ae222ab49dac2e79f616df206
-
SHA256
a2c51b0b8258d1cb4ab44318aead8c276d6b3f255bf26f3cdf2601e727cd6f6b
-
SHA512
08e384eadf37be1185c4a0643edf02099f2e1a0422affda8cf72dc185338c797166673d58dbc997ba8a402900d8b4410c6d670d66e3c6a4e41fed6eacb37576d
-
SSDEEP
6144:bHlRVuQey8WQ740ygZaTr3KdadW66OcAO+evBToSlpIKUr8oSSI:TlR4dy8WQzNw3/dW66jA+vBToWaNr8ou
Score
7/10
Malware Config
Signatures
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AhnRpt.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AhnRpt.exe"1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB